--- meta: author: "Christian S.J. Peron" enabled: true name: "921140.yaml" description: "Tests for protocol based attacks" tests: - test_title: 921140-1 desc: "HTTP Header Injection Attack via headers" stages: - stage: input: dest_addr: "127.0.0.1" method: "GET" port: 80 headers: Host: "localhost" SomeHeader: "Headerdata\rInjectedHeader: response_splitting_code" uri: "/" output: status: [400] no_log_contains: "id:921140" - test_title: 921140-2 desc: "HTTP Header Injection Attack via headers" stages: - stage: input: dest_addr: "127.0.0.1" method: "GET" port: 80 headers: Host: "localhost" SomeHeader: "Headerdata%0dInjectedHeader: response_splitting_code" uri: "/" output: no_log_contains: "id:921140"